diff --git a/stacks/park/README.md b/stacks/park/README.md
index 80fd5f1..83ad4a6 100644
--- a/stacks/park/README.md
+++ b/stacks/park/README.md
@@ -14,7 +14,12 @@ deployed at tag **v1.0.0-beta.2** (commit `2c258f7`). Owned by `park-dev`.
   backup source — no per-volume add needed. (⚠ nh3-docker's restic repo was broken as of
   2026-08-12 — see fleet infra notes.)
 - **Secret:** `PARK_API_KEY` from the vault (`secret get nh3-dev/park-api-key`), in the
-  host `.env` (chmod 600). `/healthz` is unauthenticated; `/park/*` needs the bearer key.
+  host `.env` (chmod 600). `/healthz` and the UI shell are unauthenticated, asset GETs
+  under `/ui/assets/` are public, and `/park/*` needs the bearer key.
+  **The key is 5 characters, and that is a settled decision — leave it.** Surfaced to
+  the operator 2026-08-18 with a rotation offer; ruled *leave as is*. The service is
+  LAN/WG-internal and never internet-exposed, so the exposure is "already on the
+  network", not the open web. Do not re-flag this on the next audit.
 - **Health:** `GET /healthz` → `{"status":"ok"}` (image `HEALTHCHECK` built in).
 
 ## Image is built locally (no registry yet)